3ac03db45efef9c030aaed57679852c115da7826273f01da3479e7cf7546c967

General

Target
79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe
Size 894KB
Sample240625-csq2vswarb
SHA256 79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d
MD5 944e4ba5bc1ca08b9892a1f1fede47a0
SHA1 7329b5c14adc82719147736146633043ed001b95
SHA512 d655f6e63aee67ad3f71a895a863de2856f6a11f5bd2284a6252e5ed07599c2d4a1d00d02808c6e5987bd9240546bb02cb45f93d91b312c42382ff91728fad1b
SSDEEP 12288:CqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4T7:CqDEvCTbMWu7rQYlBQcBiT6rprG8aA7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{384EA23F-5E40-409B-B40F-86C268C9043E}	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe
4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe
4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe
4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe
4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe
4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe
4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1168	4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe	88
PID 4980 wrote to memory of 1168	4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe	88
PID 4980 wrote to memory of 5080	4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe	90
PID 4980 wrote to memory of 5080	4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe	90
PID 4980 wrote to memory of 4452	4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe	97
PID 4980 wrote to memory of 4452	4980	79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe	97

C:\Users\Admin\AppData\Local\Temp\79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe
"C:\Users\Admin\AppData\Local\Temp\79b6ef01c7669190495418588a71274592996d9a3aae29530cd3601e31bce73d.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=3984,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
1⤵
PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4004,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
1⤵
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5264,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
1⤵
PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5420,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
1⤵
PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5436,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
1⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5496,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
1⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6120,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
1⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6440,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
1⤵
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6432,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
1⤵
- Modifies registry class
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5456,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
1⤵
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=6612,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
1⤵
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=6748,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads